I should mention to access the user's roles in cloak there is one thing that must be done in order for the code I have above to work correctly.  When entering the username and email address for the user in Keycloak the username must match the first portion of the address before the @ sign.  This is because Liferay will use that first portion to create the  user's screen name in Liferay.  My code uses the screen name to call back to Keycloak in order to retrieve the roles using Keycloak's Rest API. I know its not a perfect solution and I may need to rethink this at a later date.

One thing I recently became aware of is that many of the Keycloak Restful API calls have a max query parameter to limit the number a of records that the call actually returns.  What the Keycloak documentation neglected to mention is that there is a default for this max parameter which seems to be normally set to 100 records.  I ran into this default setting on the one call I was making in my code above:

GET /{realm}/clients/{id}/roles/{role-name}/users

I had to add the setting of the max query parameter to overcome this limit of 100:

    Map<String, String> params = new HashMap<String, String>();             params.put(MAX, AUTH_SERVICE_ROLES_MAX);

            String roleUserPath = AUTH_SERVICE_ROLES_PATH + SLASH + authServiceRole + USERS_PATH;             Response response = client.get(AUTH_SERVICE_URL, roleUserPath, MediaType.APPLICATION_JSON, params,                     accessToken);

It would be better if the API didn't limit the call with a default unless specified by the developer.

Hello, 

thank you for this post.  Did you try to use this plugin ( OpenID Connect  Plugin ) with Liferay 7.1 and  Keycloak 7.*?

The last supported version in the list of current requirementsof this plugin in the Liferay Marketplace is Liferay DXP 7.0 GA1+.

Now, I am wondering, if this plugin is compatible with liferay 7.1 and 7.2.

Do you know something about it?

Thanks  Best regards Viktoria

Hi William, thank you for this blog post.Do you know if the out-of-the-box SSO openid connect integration available in Liferay 7.3 also automatically imports users' roles at login?I have configured Liferay to use KeyCloak as SSO service and it works fine. The users stored in KeyCloak are automatically imported (created) in Liferay at login time. Now I am trying to make it also import roles.I have configured KeyCloak to make it send roles to Liferay both through the id_token (returned by /token call) and /userinfo endpoints. The roles are added in the responses of these endpoints as a JSON array assigned to an attribute named "roles" (customizable KeyCloak side). The elements of this array are simple strings corresponding to the "roles keys" as defined in Liferay (User, Owner, ...); but that doesn't seem to be enough for Liferay

Do you know if Liferay requires roles to be sent in another format? Maybe with a different attribute name than "roles"'?

Thank you

Mario 

I recently realized the classic integration scenario between Liferay and Keycloak using the OpenID Connect protocol and the Liferay OOTB connector. I reported in this article How to connect Keycloak and Liferay via OpenID Connect (https://bit.ly/keycloak-liferay-openid-connect) the complete experience.